FIC Directive 10 Practical Guide
FIC Directive 10: A Practical Guide to the New Geographic Location Requirements
FIC Directive 10 requires specified accountable institutions to provide the Financial Intelligence Centre with information about the geographic locations of their operations, branches and subsidiaries.
What is FIC Directive 10?
The Financial Intelligence Centre issued and published final Directive 10 on 31 July 2026. The Directive commenced on that date. It expands the information that specified accountable institutions must provide when registering with the FIC.
The FIC wants a clearer picture of where an accountable institution and its group operate. This information will help the FIC and supervisory bodies understand group structures and apply risk-based supervision more effectively.
Who must comply with FIC Directive 10?
Directive 10 applies only to the accountable institutions specifically listed in paragraph 4. These are:
- legal practitioners under item 1;
- trust and company service providers under item 2;
- estate agents or property practitioners under item 3;
- gambling businesses under item 9;
- credit providers under item 11, excluding banks, mutual banks and co-operative bank credit providers;
- the South African Postbank under item 14;
- high-value goods dealers under item 20;
- the South African Mint Company in the circumstances covered by item 21; and
- crypto asset service providers under item 22.
Does FIC Directive 10 apply to FSPs?
Not automatically. An ordinary financial services provider is not included in Directive 10 merely because it holds an FSCA licence. FSPs are not one of the categories listed in paragraph 4 of the Directive.
However, an FSP may still be affected if the same legal entity also conducts business covered by one of the listed items. For example, an FSP that also carries on the business of a credit provider or crypto asset service provider must assess its obligations under that additional status.
| Institution profile | Directive 10 position |
|---|---|
| FSP only | Not covered solely because it is an FSP. |
| Credit provider only | Covered as an item 11 accountable institution. |
| FSP and credit provider | Covered because of its item 11 credit-provider status. |
| FSP and CASP | Covered because of its item 22 crypto asset service provider status. |
Which business locations must be disclosed?
An affected institution with operations in more than one geographic location must assess the full operating structure. The review should cover:
- the accountable institution’s head office;
- every branch in South Africa;
- every branch outside South Africa;
- the head office of every subsidiary in South Africa;
- the head office of every foreign subsidiary;
- every South African branch of a subsidiary; and
- every foreign branch of a subsidiary.
A branch includes a physical office away from the head office where business is conducted for the accountable institution and products or services are provided directly or indirectly to clients.
What information must be provided for each location?
Prepare the following information for every reportable head office, branch, subsidiary head office and subsidiary branch:
| Required field | What to prepare |
|---|---|
| Name | The recognised name of the head office, branch or subsidiary location. |
| Licence number | The applicable regulatory licence number, where relevant. For a credit provider, this may include the NCR registration number. |
| Registration number | The CIPC or other applicable legal registration number, where relevant. |
| Business address | The full physical business address of that location. Do not rely only on a postal address. |
| Compliance contact | The first name, surname and contact particulars of the person carrying out the section 42A(2)(b) compliance function who may be contacted about that location. |
Practical examples for credit providers
| Scenario | Practical treatment |
|---|---|
| One lending office | Confirm that the registered address and compliance contact are accurate. Record that the institution has no additional branches or subsidiary locations. |
| Head office plus two loan branches | Gather and submit the prescribed details for the head office and both branches. |
| Agents operating from temporary locations | Do not assume that each agent is a branch. Assess whether any location is a physical office from which the credit provider conducts business or serves clients. |
| Separate collections company | Determine whether it is a subsidiary as defined in Directive 10. A third-party service provider is not automatically a subsidiary or branch. |
| Subsidiary lending company | Map ownership and control. If it falls within the Directive’s subsidiary definition, include its head office and relevant branches. |
When is the FIC Directive 10 deadline?
FIC Directive 10 commenced on 31 July 2026. Institutions that were already registered with the FIC on that date must provide the required geographic-location particulars within 90 days.
Affected accountable institutions should complete and submit their registration updates no later than this date. Preparing the information early will leave time to resolve unclear branch or subsidiary classifications before submission.
Thereafter, an affected institution must update the information within 90 days after any change. A newly registering institution must provide the information as part of its registration.
What should affected institutions do now?
Identify every Schedule 1 category under which the legal entity is registered or conducts accountable-institution business.
List the head office, all branches, all subsidiaries and every subsidiary branch in and outside South Africa.
Separate true branches and subsidiaries from remote workers, representatives, agents and independent service providers.
Verify names, licence numbers, registration numbers, physical addresses and compliance contacts.
Use the required FIC registration channel and submit the information within the applicable 90-day period.
Save the location register, internal approval, submission confirmation and any correspondence with the FIC.
Add a trigger so that new, moved or closed offices and changes to group structures are reported within 90 days.
Who should own the Directive 10 process?
The institution’s board or senior management remains responsible for FIC Act compliance. Operationally, the section 42A compliance function should coordinate the review and keep the evidence.
However, the compliance person will usually need information from company secretarial, operations, human resources, licensing and finance teams. This is especially important where a group has several legal entities or offices.
What happens if an institution does not comply?
Directive 10 is compulsory. It is issued under section 43A of the FIC Act and has legal force. Failure to comply may result in an administrative sanction under sections 43B, 61A and 45C of the FIC Act.
Even where an institution has only a simple structure, it should be able to show that it assessed the Directive, confirmed its locations and kept its FIC registration details accurate.
Frequently asked questions about FIC Directive 10
Must every branch register separately with the FIC?
No. Directive 10 requires geographic information about relevant branches and subsidiaries. It does not, by itself, turn a branch that is not a separate accountable institution into a separately registered accountable institution.
Does a company with one office have to invent branch information?
No. Confirm that the head-office and contact details are correct, document that there are no additional reportable locations and retain the assessment.
Is an independent agent or service provider a subsidiary?
Not automatically. The Directive looks at voting control and control over the appointment or election of directors. Apply the definition to the actual ownership and control structure.
Does Directive 10 replace normal FIC registration updates?
No. It adds specific geographic-location particulars and a 90-day change requirement for the affected institutions.
Final practical takeaway
FIC Directive 10 should not become a last-minute data exercise. The strongest response is to confirm scope early, create an accurate location register, resolve uncertain classifications and prepare the supporting information before the deadline.
For credit providers, this means checking every lending office and the wider group structure. For FSPs, it means first confirming whether the entity also falls within one of the categories covered by the Directive. That targeted approach keeps the response accurate and avoids unnecessary work.